text: Often times they dont. If a smaller company has a breach and usernames / passwords get leaked they use bots to try them across many providers as most people use the same password everywhere. Google / bing / duckduckgo search your password from time to time to see if your password is posted on a list somewhere